Full Disclosure mailing list archives
Re: unknown backdoor: 220 StnyFtpd 0wns j0
From: Ryan Sumida <rsumida () csulb edu>
Date: Thu, 23 Sep 2004 13:24:58 -0700
Thank you all for the help, I definitily appreciate it. The last system I checked had ftp running on port 15708 which makes me believe it is not the WORM_KIBUV.B but a similar variant. Sorry for the unnecessary post, I googled the whole string which didn't come back with anything. I should have just googled "StnyFtpd". Thanks again, Ryan full-disclosure-admin () lists netsys com wrote on 09/23/2004 10:42:13 AM:
I've been finding a few compromised Windows systems on our campus that have a random port open with a banner of "220 0wns j0". All the systems seem to be doing SYN scans on port 445 and LSASS buffer overflow attempts. Anyone know what worm/bot is doing this? I don't have access to these machines so I can only get a network view of what the systems are doing. Thanks, Ryan
Current thread:
- unknown backdoor: 220 StnyFtpd 0wns j0 Ryan Sumida (Sep 23)
- Re: unknown backdoor: 220 StnyFtpd 0wns j0 Harlan Carvey (Sep 23)
- Re: unknown backdoor: 220 StnyFtpd 0wns j0 joe smith (Sep 23)
- Re: unknown backdoor: 220 StnyFtpd 0wns j0 Ryan Sumida (Sep 23)
- Re: unknown backdoor: 220 StnyFtpd 0wns j0 joe smith (Sep 23)
- Re: unknown backdoor: 220 StnyFtpd 0wns j0 Mike Iglesias (Sep 23)
- <Possible follow-ups>
- RE: unknown backdoor: 220 StnyFtpd 0wns j0 Todd Towles (Sep 23)
- Re: unknown backdoor: 220 StnyFtpd 0wns j0 mike king (Sep 23)
- RE: unknown backdoor: 220 StnyFtpd 0wns j0 Elliott, James (Sep 23)
- RE: unknown backdoor: 220 StnyFtpd 0wns j0 Fowler, Mike (Sep 23)
- RE: unknown backdoor: 220 StnyFtpd 0wns j0 Constantinidis, Alex (Sep 24)